System and method for managing memory in a mobile device

Abstract

A system and method for managing memory in a mobile device to prevent the swapping out of sensitive data to non-volatile storage from a volatile memory, to provide enhanced security for the sensitive data. In one broad aspect, there is provided a method of managing memory in a mobile device comprising the steps of identifying one or more data objects stored in a volatile memory on the mobile device to be swapped out to a non-volatile storage component, determining objects marked as containing sensitive data, and retaining so-marked objects in the volatile memory of the mobile device.

1 . A method of managing memory in a mobile device to prevent the swapping out of sensitive data to non-volatile storage during the execution of one or more programs on the mobile device, the method comprising the steps of: 
 a) identifying one or more data objects stored in a volatile memory on the mobile device to be swapped out to a non-volatile storage component;    b) determining a first subset of the one or more data objects, wherein each data object belonging to the first subset is marked as containing sensitive data; and    c) retaining the first subset of data objects in the volatile memory of the mobile device, such that the first subset of data objects is not swapped out to the non-volatile storage component.    
   
   
       2 . The method of  claim 1 , further comprising the step of swapping at least one data object not in the first subset out to the non-volatile storage component.  
   
   
       3 . The method of  claim 1 , wherein the non-volatile storage component resides on the mobile device.  
   
   
       4 . The method of  claim 1 , wherein a data object of the one or more data objects is determined to belong to the first subset in the determining step if the data object contains an attribute having a value that indicates that the object has been marked as containing sensitive data.  
   
   
       5 . The method of  claim 1 , wherein a data object of the one or more data objects is determined to belong to the first subset in the determining step if the data object is determined to be an instance of a class or an interface that defines an implementation for objects that are to contain sensitive data.  
   
   
       6 . The method of  claim 1 , wherein a data object is considered as being marked as containing sensitive data if at least one of the following conditions is true: 
 i) the data object itself is marked as containing sensitive data;    ii) the data object contains a second data object, where the second data object is marked as containing sensitive data.    
   
   
       7 . The method of  claim 1 , wherein a data object is considered as being marked as containing sensitive data if it is passed as a parameter into a sensitive function.  
   
   
       8 . A software application comprising a plurality of instructions stored on a computer-readable medium, the instructions for a method of managing memory in a mobile device as claimed in  claim 1 .  
   
   
       9 . A system for managing memory in a mobile device to prevent the swapping out of sensitive data to non-volatile storage during the execution of one or more programs on the mobile device, the system comprising: 
 a processor;    a volatile memory coupled to the processor;    a non-volatile storage component coupled to the processor;    a memory management component that controls the swapping of data objects between the volatile memory and the non-volatile storage component during the execution of the one or more programs by the processor; wherein the memory management component is adapted to perform the steps of    a) identifying one or more data objects stored in a volatile memory on the mobile device to be swapped out to a non-volatile storage component,    b) determining a first subset of the one or more data objects, wherein each data object belonging to the first subset is marked as containing sensitive data, and    c) retaining the first subset of data objects in the volatile memory of the mobile device, such that the first subset of data objects is not swapped out to the non-volatile storage component.    
   
   
       10 . The system of  claim 9 , wherein the memory management component is implemented in a virtual machine on the mobile device.  
   
   
       11 . The system of  claim 9 , wherein the memory management component is further adapted to perform the step of swapping at least one data object not in the first subset out to the non-volatile storage component.  
   
   
       12 . The system of  claim 9 , wherein the non-volatile storage component resides on the mobile device.  
   
   
       13 . The system of  claim 9 , wherein a data object of the one or more data objects is determined to belong to the first subset in the determining step if the data object contains an attribute having a value that indicates that the object has been marked as containing sensitive data.  
   
   
       14 . The system of  claim 9 , wherein a data object of the one or more data objects is determined to belong to the first subset in the determining step if the data object is determined to be an instance of a class or an interface that defines an implementation for objects that are to contain sensitive data.  
   
   
       15 . The system of  claim 9 , wherein a data object is considered as being marked as containing sensitive data if at least one of the following conditions is true: 
 i) the data object itself is marked as containing sensitive data;    ii) the data object contains a second data object, where the second data object is marked as containing sensitive data    
   
   
       16 . The system of  claim 9 , wherein a data object is considered as being marked as containing sensitive data if it is passed as a parameter into a sensitive function.